Paignton Zoo Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People connected to Paignton Zoo — staff, supporters, partners or others whose details may sit in its systems — face the practical risk that internal files taken in a ransomware attack could now be in the hands of criminals. Public reporting lists the organisation as a victim of the medusa group, with a claimed volume of data already removed from its network. Exact numbers of individuals affected remain unknown, so anyone who has shared personal or contact information with the zoo has reason to treat the incident as potentially relevant to them.

The listing itself is a claim by the threat actor rather than an independently verified confirmation of every detail. Still, the reported scale of the theft and the nature of a working zoo and charity mean the exposure could touch employment records, donor or visitor data, and operational files. Understanding what is known, and what is not, helps those who may be affected decide on next steps without unnecessary alarm.

What happened

On 11 February 2025, Paignton Zoo was reported as listed by the medusa ransomware group. According to the available record, internal files were exfiltrated during a ransomware attack. The total volume of data claimed to have been taken is 271.60 GB. The number of people affected is unknown, and no further public detail has been given on the precise date of intrusion, the initial access method, or whether a ransom demand was paid or refused.

Public information stops at the leak-site listing and the stated data volume. No independent confirmation of the full contents of the files, or of any subsequent public dump, appears in the facts provided. The incident is therefore described as a claimed ransomware event involving exfiltration of internal material rather than a fully documented breach with audited victim counts.

The group behind it: medusa

Medusa is a ransomware operation that has operated for several years using a double-extortion model: encrypting systems while also stealing data, then threatening to publish the material if payment is not made. The group typically posts victims on a dedicated leak site, often with sample files or volume claims, and has targeted organisations across multiple sectors including education, healthcare, manufacturing and public services. Its tactics commonly involve initial access through phishing, compromised credentials or unpatched remote services, followed by lateral movement and data staging before encryption.

In this case the group claims Paignton Zoo as a victim and asserts that 271.60 GB of internal files were taken. No additional statements attributed specifically to medusa about this organisation — such as deadlines, sample file lists or ransom figures — are present in the reported facts. The listing should therefore be treated as an unverified claim by the actor until further independent evidence emerges.

Who is Paignton Zoo?

Paignton Zoo is a large zoo and conservation organisation based in Paignton, Devon, United Kingdom, with its corporate office at Zoo Totnes Road, Paignton Torquay, Devon, TQ4 7EU. It functions both as a visitor attraction and as a charitable body engaged in animal care, breeding programmes and conservation work. The organisation is reported to employ 86 people.

Like other zoos and charities of similar size, it typically maintains records relating to staff, volunteers, donors, suppliers, membership or ticketing systems, veterinary and animal-management data, and day-to-day corporate administration. A breach at such an organisation is consequential because the data often mixes personal identifiers with financial, health-related or operational information that can be reused for fraud, phishing or further intrusion. The combination of public-facing visitor services and charitable fundraising also means contact details for a wide circle of individuals may be held.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack and that the claimed volume is 271.60 GB. No more granular inventory of file types, databases or individual records has been disclosed. Organisations of this kind commonly hold employee personnel files, payroll and HR data, donor and membership lists, email correspondence, supplier contracts, visitor or booking information, and operational documents relating to animal care and site management. Whether any of those categories were among the taken files remains unconfirmed.

Because the precise contents are not publicly detailed, it is not possible to state as fact that any specific category of personal data was exposed. The only confirmed description is “internal files” at the stated volume. Affected individuals should therefore assume a range of possibilities until the organisation or independent investigators provide a clearer inventory.

Why it matters

For people whose information may have been among the files, the practical risks include targeted phishing that references genuine zoo-related details, identity fraud if names, addresses or financial identifiers were present, and the longer-term reuse of credentials or contact data. Even internal operational documents can reveal enough about processes or individuals to make social-engineering attacks more convincing. The unknown number of people affected means the circle of potential impact cannot yet be drawn tightly.

For the organisation itself, the incident carries operational, reputational and regulatory consequences. A zoo and charity depends on public trust and on the security of both visitor-facing systems and conservation data. Recovery from ransomware typically involves system restoration, forensic review and notification obligations under data-protection rules. The claimed 271.60 GB volume indicates a substantial collection of material left the network, which can prolong the period of uncertainty for anyone whose details may be inside it.

What to do if you're exposed

If you have worked for, donated to, visited regularly, or otherwise shared personal details with Paignton Zoo, treat the incident as potentially relevant until more is known. Practical first steps include:

• Monitor bank and credit accounts for unexpected activity and enable transaction alerts where available.
• Be wary of unsolicited emails, calls or messages that reference the zoo, conservation work or past donations; verify any request through official channels you already trust.
• Change passwords for accounts that may have reused credentials linked to zoo-related services, and enable multi-factor authentication wherever possible.
• Request a copy of any personal data the organisation holds about you if you wish to understand the scope of your own records.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach data sets.

These measures do not require confirmation that your specific file was taken; they simply reduce the chance that any exposed information can be used against you while further details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.